Article ID: 2691973 - View products that this article applies to.
Configuring System Center Operations Manager to monitor plain text and delimited text log files from various sources is straightforward but there are some scenarios of which to be aware.
See the link below for instructions on how to create a Simple Event Detection monitor for a plain text (non-delimited) log file in System Center Operations Manager 2007 and 2007 R2:
1. Log on to the computer with an account that is a member of the Operations Manager Administrators user role or Operations Manager Authors user role for the Operations Manager management group.
2. In the Operations console, click the Authoring button.
3. In the Authoring pane, expand Authoring, expand Management Pack Objects, and then click Rules.
4. In the toolbar, click Scope.
5. In the Scope Management Packs Objects dialog box, in the Find text box, type Windows Computer, select the Windows Computer target check box, and then click OK.
6. In the Rules pane, right-click Windows Computer and then click Create a New Rule
7. In the Create Rule Wizard, on the Select the type of rule to create page, expand Collection Rules, expand Event Based, and select Generic Text Log or Generic CSV Text Log
8. Select a management pack from the Select destination management pack list (in System Center Operations Manager 2012, this list picker is labeled Select Management Pack) or create a new unsealed management pack by clicking New. By default, when creating a management pack object, an override, or disabling a rule or monitor, Operations Manager saves the setting to the Default Management Pack. As a best practice, create a separate management pack for each sealed management pack to be , rather than saving customized settings to the Default Management Pack. For more information, see Default Management Pack.
9. Click Next
10. On the General page, in the Name box, type a name for the rule, and then as an option, you can type a description.
11. Click the Rule Category arrow, select the appropriate category, and then click Next.
12. On the Application Log Data Source page under Define the application log data source, in the Directory text box, type a path to where the log files are located, for example, C:\logfiles
13. In the Pattern text box, type a pattern string to select log files. For example, application??.log will find any log file that starts with ‘application’ followed by zero to two characters with an extension of ‘.log’ (e.g. application.log, application1.log, application01.log, etc.).
14. For CSV log types, enter the separator. The separator does not have to be a comma, but it must be a printable character
15. Select UTF8 if applicable, and then click Next
16. On the Build Event Expression page (for the Build First Expression),click Insert and then do the following:
a. Under Parameter Name (on the left), type Params/Param. Params/Param is the only field available for Generic Text log, since each line in the file is considered a single field. For Generic CSV Text Log, the number in Params/Param[x] represents the field on which the operation will take place. For example, Params/Param is the first field of the delimited file; Params/Param is the second field of the delimited file, and so forth.
b. Under Operator, click the pull down menu and select an operator, for example Contains
c. Under Value enter the text that this monitor should trigger on as found in the log file, for example error
17. Click Create to create the rule. If Alert Generating Rules was chosen in step 7A, click next to configure the alert, then click Create to create the rule.
After the rule is created, edit the properties of the new rule to generate an alert when the rule is triggered. See How to Edit Properties of a Rule in Operations Manager 2007 for more information on editing the properties of a rule.
Each line of a log file must end with a new line (0x0A0x0A hex sequence) before it will be read and processed by Operations Manager.
If a rule or monitor is configured to match a pattern for log file names (e.g. using the ? or * wildcard characters), it is important that only ONE log that matches the pattern is written. If multiple logs that match the pattern are being written to, the high water mark is reset to the beginning of the file with each write to a different file. The result is that all previous log entries will be reprocessed.
Starting with Operations Manager 2012 R2, if a log file is cleared or renamed/deleted and then recreated, Operations Manager will read the file from the first line. Prior versions of Operations Manager behave as follows:
When monitoring a log file, Operations Manager remembers the last line read within the file (a 'high water mark'). It will not re-read data before this point unless the file is deleted and recreated, or renamed and recreated, which will reset the high water mark.
If a logfile is deleted and recreated with the same name within the same minute, the high water mark will not be reset, and log entries will be ignored until the high water mark is exceeded.
(http://go.microsoft.com/fwlink/?LinkId=151500)for other considerations.
Article ID: 2691973 - Last Review: January 15, 2015 - Revision: 7.0